DNA Software Under Scrutiny

DNA Software Under Scruitiny

Probabilistic Genotyping Used for Criminal Prosecution

In a recent article published on The Markup, software that is used to match DNA in criminal prosecution has come under scrutiny.  The software implements what is known as probabilistic genotyping, a method used when analyzing data that contains a mixture of DNA from multiple people.  The software uses complex statistical algorithms to determine to compare the likelihood that a person’s unique DNA versus a random person’s DNA is present in a mixture.

Of course the benefit of such analysis tools could be the removal of potential bias or of human error.  On the downside, however, the defendant and his or her defense team do not have access to the algorithms.  Obviously there would be at least two concerns that have led to the DNA matching software coming under scrutiny:

  • How would one know if the algorithm had been tampered with or altered to bias in one way or the other?
  • How would one know if the software itself had been developed to any quality standard, and that the particular release of software included necessary error checks (we might call these risk controls in medical device lingo)?

Concerns with Use of Software

The article quoted Mats Heimdahl (Professor and Department Head, Computer Science & Engineering, University of Minnesota) and Jeanna Matthews, two computer science experts: “It is virtually certain that there are flaws in the TrueAllele software,” wrote  in a declaration to the federal court. “On average, there will be six flaws for every 1,000 lines of code, and TrueAllele has 170,000 lines of code.”

As software professionals in the medical device software field, we have a responsibility to ensure both appropriate security controls and appropriate software lifecycle controls.  For the software lifecycle process itself, of course IEC 62304 (See our post on 62304-FDA Compliance Training) is our standard and is recognized by US FDA as a consensus standard.  However, beyond the process rigor, the difference between high quality software and software of lower quality is often directly related to the defensive coding designs and the built-in error checking and recovery designs.  The exact methods used will depend upon the programming technologies selected, the intended use, the worst-case (or worst-cases) outcome, and other factors.  We must understand the ramifications of software failures.  If we believe the software experts in this column, there could be over 1,000 flaws or defects in that code.  Our process needs to reduce that number and our defensive coding and error-checking should be designed to reduce the likelihood that, should any of those defects occur, an acceptable outcome or output would be generated.

Read the article at this link:  https://themarkup.org/news/2021/03/09/powerful-dna-software-used-in-hundreds-of-criminal-cases-faces-new-scrutiny

About the author

Brian Pate helps medical device companies achieve efficient and FDA regulatory compliant product development to produce higher quality and clinically valued software. He began his career in clinical research in 1985 with the Department of Anesthesiology at UAB developing closed-loop control systems for the automated delivery of gases and control. In 1990, he made the switch from university research to the medical device industry designing control systems, communication interfaces, user interface, and other software for real-time embedded systems and clinical information systems, working for medical device companies including Johnson & Johnson, Baxter Healthcare, and GE Medical. Today, he is a Partner and the General Manager of Crisis Prevention and Recovery LLC (dba SoftwareCPR®), a general-purpose regulatory consulting firm that is recognized globally for their expertise with standards and national regulations pertaining to medical device, mobile medical app, and HealthIT software. He has taught the AAMI/FDA course on Software Regulation to FDA Reviewers at FDA and is currently the lead faculty for the public version of that course taught annually along with FDA staff. Brian served on the AAMI/FDA TIR working group that created AAMI TIR32 Guidance on the application of ISO 14971 to Software (later superseded by IEC 80002-1). He later served on the original AAMI/FDA working group that created the AAMI TIR45-2012 TIR Guidance on the use of Agile practices in the development of medical device software and is currently the co-chair leading the creation of the 2nd edition of TIR45. He has served as faculty for all offerings of the AAMI/FDA Compliant Use of Agile Methods public course. Brian also served as an instructor for the AAMI Design Controls course. He is also a member of the Underwriters’ Laboratories Standards Technical Panel 5500, Remote Software Updates. He now serves as a member of the AAMI Software Committee.

Cybersecurity Review

Our cybersecurity experts are NESSUS Pro Licensed and can quickly remediate cybersecurity deficiencies with your medical device or digital health software.  Planning, requirements, validation, and submissions – we can assist with all.

Interested in having a conversation?  Email us to arrange a Zoom meeting or call us at +1 781-721-2921.

office@softwarecpr.com

Corporate Office

15148 Springview St
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN), Canada, and Italy.